CVE-2026-35362

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35362", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-04-02T12:58:56.088Z", "datePublished": "2026-04-22T16:08:33.266Z", "dateUpdated": "2026-04-22T17:28:40.509Z"}, "containers": {"cna": {"title": "uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module", "affected": [{"vendor": "Uutils", "product": "coreutils", "platforms": ["Unix", "macOS", "FreeBSD"], "collectionURL": "https://github.com/uutils", "packageName": "coreutils", "repo": "https://github.com/uutils/coreutils", "versions": [{"status": "affected", "lessThan": "0.6.0", "version": "0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-29", "descriptions": [{"lang": "en", "value": "CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"}]}], "descriptions": [{"lang": "en", "value": "The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions."}], "references": [{"url": "https://github.com/uutils/coreutils/pull/9792", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.6, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Zellic", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-22T16:08:33.266Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T17:25:54.781571Z", "id": "CVE-2026-35362", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T17:28:40.509Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35362", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:25:54.781571Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T17:28:37.362Z"}}], "cna": {"title": "uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Zellic"}], "impacts": [{"capecId": "CAPEC-29", "descriptions": [{"lang": "en", "value": "CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "versions": [{"status": "affected", "version": "0", "lessThan": "0.6.0", "versionType": "semver"}], "platforms": ["Unix", "macOS", "FreeBSD"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/uutils/coreutils/pull/9792", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-22T16:08:33.266Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35362", "state": "PUBLISHED", "dateUpdated": "2026-04-22T17:28:40.509Z", "dateReserved": "2026-04-02T12:58:56.088Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-04-22T16:08:33.266Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/uutils", "defaultStatus": "unaffected", "packageName": "coreutils", "platforms": ["Unix", "macOS", "FreeBSD"], "product": "coreutils", "repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "versions": [{"lessThan": "0.6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*", "matchCriteriaId": "87C33018-2E08-45B0-B69C-7FC224F7F883", "versionEndExcluding": "0.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions."}, {"lang": "es", "value": "El m\u00f3dulo safe_traversal en uutils coreutils, que proporciona protecci\u00f3n contra las condiciones de carrera de enlaces simb\u00f3licos (symlink races) de tipo Time-of-Check to Time-of-Use (TOCTOU) utilizando llamadas al sistema (syscalls) relativas a descriptores de archivo, est\u00e1 incorrectamente limitado a objetivos Linux. En otros sistemas tipo Unix como macOS y FreeBSD, la utilidad no logra utilizar estas protecciones, dejando las operaciones de salto de directorio vulnerables a condiciones de carrera de enlaces simb\u00f3licos."}], "id": "CVE-2026-35362", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 2.5, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35362", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T17:25:54.781571Z", "version": "2.0.3"}}]}, "published": "2026-04-22T17:16:38.960", "references": [{"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/uutils/coreutils/pull/9792"}, {"source": "security@ubuntu.com", "tags": ["Release Notes"], "url": "https://github.com/uutils/coreutils/releases/tag/0.6.0"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["unix", "macos", "freebsd"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "coreutils", "source": "cna", "vendor": "Uutils"}, "product": "coreutils", "vendor": "uutils"}], "analysis": {"en": {"generated_at": "2026-04-28T20:42:29.719303+00:00", "value": {"mitigation_remediation": ["Upgrade uutils coreutils to version 0.6.0 or later to restore TOCTOU protection on non\u2011Linux platforms.", "If an immediate upgrade is not feasible, limit the use of vulnerable commands to directories that are not writable by untrusted users; consider moving critical operations to a root\u2011owned or immutable filesystem.", "Implement monitoring or intrusion detection to watch for unexpected symlink creation in critical directories, and apply file\u2011system quarantine policies to detect and mitigate race conditions."], "summary": {"action": "Patch Update", "impact": "Directory Traversal via TOCTOU Race"}, "threat_synthesis": {"affected_systems": "uutils coreutils is an open\u2011source Rust implementation of GNU Coreutils. The safe_traversal module that protects against TOCTOU symlink races works only on Linux. On macOS, FreeBSD, and other Unix\u2011like systems the module falls back to non\u2011protected logic, exposing directory traversal operations to symlink race conditions. All releases of uutils coreutils before 0.6.0 exhibit this flaw on those platforms; 0.6.0 and later restore protection. The affected software is deployed on any Unix\u2011like host that runs the vulnerable command\u2011line utilities from uutils, which may include servers, build environments, or end\u2011user systems.", "description_and_impact": "The safe_traversal module in uutils coreutils is designed to guard against Time\u2011of\u2011Check to Time\u2011of\u2011Use (TOCTOU) symlink races by using file\u2011descriptor\u2011relative system calls; however, the protection is hard\u2011coded to activate only on Linux. On macOS, FreeBSD and other Unix\u2011like systems the guard is bypassed, leaving directory traversal operations susceptible to a symlink race. This flaw falls under CWE\u2011367. While it does not directly enable code execution or privilege escalation, an attacker can replace a target file with a malicious symlink between the check and use phases, allowing unauthorized modification, deletion, or injection of files and potentially exposing sensitive data or causing denial of service.", "risk_and_exploitability": "The CVSS score of 3.6 indicates low to moderate severity. The EPSS score of <1% denotes a very low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog, so no confirmed widespread exploitation is reported. Exploitation would require the attacker to influence the file system at the time the vulnerable command runs, such as substituting a target file with a malicious symlink during the race window. This could allow unauthorized modification, deletion, or injection of files, potentially exposing sensitive data or causing denial of service. The most plausible attack vector is local or remote\u2011directed, but the need for precise timing and the low EPSS score reduce the practical risk."}}}}, "created": "2026-04-27T19:54:19.843184+00:00", "updated": "2026-04-28T20:45:16.608153+00:00", "vendors": ["uutils", "uutils$PRODUCT$coreutils"]}